[CALCITE-5232] Upgrade protobuf-java from 3.17.1 to 3.21.5

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.31.0, avatica-1.22.0
• Fix Version/s: 1.32.0, avatica-1.23.0
• Component/s: avatica, core
• Assignee: Julian Hyde
• Reporter: Julian Hyde
• Created: 11/Aug/22 19:18
• Updated: 10/Sep/22 08:40
• Resolved: 11/Aug/22 21:38

Description

Upgrade protobuf-java in Calcite and Avatica.

Some scanning tools say that the current version, 3.17.1, is affected by CVE-2021-22569. It is not, but this upgrade makes those warnings go away.

As for CALCITE-4626, we plan to upgrade both Avatica and Calcite, to keep them on the same protobuf-java version.

Issue Links

• relates to: CALCITE-4626 Warning during build for JDK9+ projects due to com.google.protobuf.UnsafeUtil
• links to: Avatica dev branch
• links to: Calcite dev branch